Shopify CLI 5.0.0

Shopify CLI 5.0 is your agent-ready Shopify development tool. It now features a standardized JSON output format for nearly all commands, and an app dev command optimized for agentic workflows.

⚠️ Breaking Changes

Review the migration guide for details on these changes and how to adapt existing scripts and workflows.

General

• Existing JSON output structures have changed on some commands. See the migration guide for details.

App

• The app logs and app logs sources commands have been removed. Use log output from the app dev command instead for Shopify Functions.

Theme

• The --poll flag has been removed from theme dev.

New Features

App

• app dev records sessions, preview status, and JSONL logs to the filesystem, so agents can reuse a running dev session.
• app dev now supports streaming --json output for direct agent use.
• Shared namespace metafield warnings added to agentic checks in app security check (SHARED_NAMESPACE_METAFIELD_RENDER).
• App security checks now account for theme app extension settings types when checking liquid rendering safety (#8935).

Theme

• When needed, theme commands prompt for identity in the browser for security verification. In CI, with --no-input or with --json, they stop and print a verification link.

General

• The SHOPIFY_SERVICE_ACCOUNT_TOKEN can be used with Service Accounts to automate app releases and dev store management. The SHOPIFY_APP_AUTOMATION_TOKEN and SHOPIFY_CLI_PARTNERS_TOKEN environment variables are now deprecated.
• JSON output is now supported in over 90% of Shopify CLI commands.
• New Shopify loading indicator (#8136).

Patch Changes

App

• app dev watches fewer files: it skips Cargo target directories, Function build output, .shopify files and editor temp files (#8993).
• app config link no longer drops Shop scopes such as shop_app:oauth (#8977).
• Fix migration detection for legacy Checkout and POS UI extensions in App Management apps (#8854).
• Bundle every UI extension should_render target instead of only the last one (#8862).

Theme

• theme dev shows the development theme instead of the live theme on stores where every market uses a subfolder (#8880).
• Theme Access authentication works with all of a store's domains (#8822).
• theme pull keeps files inside the selected theme directory (#8834).
• Show the missing-scope message for theme changes, as theme reads already do (#8897).
• theme check --config <directory> reports a user error instead of crashing with EISDIR (#8988).
• Fix theme profile failing with "Bad response: 301" when --url has a query string (#8989).

General

• Retry throttled API requests with exponential backoff, respecting Retry-After (#8956).
• auth login no longer crashes when the browser can't open; it prints the login link and waits (#8886).
• Explain which access a token is missing for dev stores instead of printing a raw 401 (#8999).
• Fail clearly when SHOPIFY_APP_AUTOMATION_TOKEN or SHOPIFY_CLI_PARTNERS_TOKEN is set but empty (#8731).
• Report process startup failures and signal termination instead of exit code 0.
• Graceful shutdown and child-process cleanup on Windows (#8926).
• Security hardening: hide webhook secrets in debug output, partition the GraphQL cache by endpoint and token (#8888), and serialize GraphiQL inline scripts safely (#8887).